DRAGONFORCE Ransomware Gang: 4 US Victims in Single-Day Leak Batch — SMB Targeting Analysis & Detection Rules

Classification: TLP:CLEAR | Source: ransomware.live monitoring of DRAGONFORCE .onion leak site | Report Date: 2026-08-07

DragonForce's dark web leak site published four new US-based victims in a single 24-hour window on 2026-08-05, spanning healthcare, manufacturing, hospitality, and professional services. The simultaneous batch release — after a relatively quiet recent posting cadence — is a deliberate pressure tactic and signals active affiliate operations against small-to-mid-market US organizations. This briefing profiles the actor, dissects the current campaign, and delivers deployable detection content.

Threat Actor Profile — DRAGONFORCE

Aliases & Attribution: DragonForce; self-branded as the "DragonForce Ransomware Cartel" following its 2025 restructuring. First surfaced in late 2023 with hacktivist-adjacent messaging before pivoting entirely to financially motivated extortion. Assessed as a criminal operation with probable affiliate overlap with ex-RansomHub and ex-LockBit ecosystems. No nation-state attribution.

Operating Model: Ransomware-as-a-Service (RaaS). Since 2025, DragonForce has marketed a franchise/"cartel" model — affiliates can operate under the DragonForce brand or white-label their own leak site on DragonForce infrastructure in exchange for a revenue share (reported ~20%). This widened its affiliate pool significantly and explains the erratic, multi-vector victim mix.

Ransom Demands: Scaled to victim revenue. SMB victims in this batch's profile typically face demands in the low-to-mid six figures (USD 100K–750K); enterprise healthcare and manufacturing intrusions have historically exceeded USD 1M–5M. Initial demands are routinely negotiated down 30–60%.

Known Initial Access Methods:

• Exploitation of edge/VPN appliances with authentication weaknesses (consistent with Check Point CVE-2026-50751)
• Abuse of legitimate RMM platforms — notably ConnectWise ScreenConnect (CVE-2024-1708) — for foothold, persistence, and lateral movement
• Spear phishing with malicious attachments and credential stuffing against exposed RDP/VPN portals
• Managed Service Provider (MSP) compromise to push payloads to downstream SMB clients
• Collaboration with social-engineering intrusion teams (help-desk vishing / password-reset manipulation), as reported in the 2025 UK retail campaign

Extortion Model: Double extortion. Data is staged and exfiltrated before encryption; victims are posted to the .onion leak site with countdown timers, and data is dumped in tranches if negotiations stall. Leak-only extortion has also been observed where encryption failed.

Dwell Time: Assessed 3–14 days from initial access to detonation in typical affiliate intrusions; MSP-mediated pushes with pre-staged access can compress this to under 48 hours.

Current Campaign Analysis

Victims posted 2026-08-05 (single-day batch):

Sector Concentration: Manufacturing, hospitality, and healthcare — three of the four postings — align with DragonForce's opportunistic, affiliate-driven targeting. The healthcare posting (an optometry practice) continues the gang's disregard for the informal "no healthcare" norm some cartels claim to observe.

Geographic Concentration: 100% United States. Consistent with the affiliate pool's focus on US mid-market organizations with cyber insurance coverage and regulatory breach-notification obligations that increase payment pressure.

Victim Profile: All four are small-to-mid-size businesses, estimated USD 1M–50M annual revenue: an HVAC contractor ($1–10M), a specialty alloys manufacturer ($10–50M), a day spa ($1–5M), and an eye care practice ($1–10M). This is the classic MSP-served mid-market segment — organizations that rely on outsourced IT and are disproportionately exposed to RMM tooling abuse and MSP supply-chain compromise, both core DragonForce vectors.

Posting Frequency / Escalation Pattern: Four simultaneous postings in a single day after a low recent cadence (4 victims in the last-100 window) indicates a coordinated batch release — either multi-affiliate detonations held for simultaneous publication or an attention/pressure reset for stalled negotiations. Expect follow-on data dumps within 7–14 days for non-payers.

CVE / Initial Access Correlation:

• CVE-2024-1708 (ConnectWise ScreenConnect path traversal/RCE) — strongest historical fit. DragonForce affiliates have repeatedly abused RMM platforms, and ScreenConnect exploitation is confirmed in ransomware intrusions. Directly relevant to the MSP-served SMB victim profile above.
• CVE-2026-50751 (Check Point Security Gateway improper authentication, IKEv1) — matches the group's edge/VPN exploitation tradecraft for perimeter initial access.
• CVE-2026-20131 (Cisco Secure FMC / SCC deserialization) — network management plane compromise enables traffic visibility and lateral movement into flat SMB networks.
• CVE-2023-21529 (Microsoft Exchange deserialization) — authenticated Exchange RCE; on-prem Exchange remains common in this victim segment.
• CVE-2026-48027 (Nx Console embedded malicious code) — supply-chain/developer-tooling foothold; consistent with the group's opportunistic access acquisition.

Detection Engineering

SIGMA — DragonForce TTP Ruleset (deploy all three)

---
title: DragonForce Pre-Encryption Volume Shadow Copy Deletion
id: 9a4f1c2e-7b3d-4e5a-9c6f-2d8b1a5e7f03
status: experimental
description: Detects shadow copy deletion and boot recovery tampering — consistent pre-encryption staging behavior in DragonForce intrusions intended to inhibit recovery (T1490).
references:
    - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/08/07
tags:
    - attack.impact
    - attack.t1490
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'shadowcopy'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled'
            - 'bootstatuspolicy'
    selection_diskshadow:
        Image|endswith: '\diskshadow.exe'
        CommandLine|contains: 'delete shadows'
    condition: 1 of selection_*
falsepositives:
    - Legitimate backup maintenance; validate against change windows
level: high
---
title: DragonForce Lateral Movement via PsExec or Remote Service Execution
id: 4b8e2d6a-1f5c-4a9b-8e3d-6c2f9a7b5e11
status: experimental
description: Detects PsExec-style remote execution and suspicious service binary deployment consistent with DragonForce affiliate lateral movement tradecraft.
references:
    - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/08/07
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1569.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexesvc:
        Image|endswith: '\PSEXESVC.exe'
    selection_share_exec:
        ParentImage|endswith: '\services.exe'
        CommandLine|contains:
            - '\\ADMIN$'
            - '\\IPC$'
    selection_clones:
        Image|endswith:
            - '\remcom.exe'
            - '\paexec.exe'
            - '\csexec.exe'
    condition: 1 of selection_*
falsepositives:
    - Authorized remote administration tooling; baseline admin hosts
level: high
---
title: DragonForce Unauthorized RMM Tool Execution (ScreenConnect AnyDesk Splashtop)
id: 7c1f5a9d-3e8b-4f2c-b6a4-9d1e8c3f7a22
status: experimental
description: Detects execution of RMM tooling from non-standard paths. DragonForce affiliates abuse RMM platforms (notably ScreenConnect post-CVE-2024-1708) for access, persistence, and payload staging.
references:
    - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/08/07
tags:
    - attack.command_and_control
    - attack.t1219
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\ScreenConnect.ClientService.exe'
            - '\ScreenConnect.WindowsClient.exe'
            - '\AnyDesk.exe'
            - '\SRManager.exe'
            - '\AteraAgent.exe'
            - '\rutserv.exe'
            - '\netransport.exe'
    filter_standard_paths:
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    condition: selection_img and not filter_standard_paths
falsepositives:
    - Portable IT support tools; validate against authorized software inventory
level: medium

Microsoft Sentinel KQL — Pre-Ransomware Staging & Lateral Movement Hunt

// DragonForce pre-ransomware staging hunt: correlates staging/discovery/anti-recovery
// process execution with remote logons on the same host within a 4-hour window.
let lookback = 7d;
let stagingProcs = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ ("vssadmin.exe","wmic.exe","bcdedit.exe","diskshadow.exe","psexec.exe","psexesvc.exe","nltest.exe","net.exe","net1.exe","7z.exe","rar.exe","rclone.exe","megacmd.exe")
   or ProcessCommandLine has_any ("shadowcopy","delete shadows","recoveryenabled","ignoreallfailures","/domain","dclist")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let suspiciousLogons = DeviceLogonEvents
| where Timestamp > ago(lookback)
| where LogonType in ("RemoteInteractive","Network")
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." // tune to internal ranges
| project LogonTime=Timestamp, DeviceName, AccountName, LogonType, RemoteIP;
stagingProcs
| join kind=inner suspiciousLogons on DeviceName, AccountName
| where Timestamp between (LogonTime .. LogonTime + 4h)
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), DistinctCommands=dcount(ProcessCommandLine), Commands=make_set(ProcessCommandLine, 20) by DeviceName, AccountName, RemoteIP, LogonType
| order by FirstSeen asc;

PowerShell — Rapid Triage & Hardening Check (run on suspect hosts or deploy via RMM/GPO)

#requires -RunAsAdministrator
# DragonForce Rapid Triage — Security Arsenal
$ErrorActionPreference = 'SilentlyContinue'
$report = [System.Collections.Generic.List[string]]::new()
$cutoff = (Get-Date).AddDays(-7)

# 1. RDP exposure
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'
$report.Add('== RDP STATUS ==')
$report.Add('RDP Enabled (fDenyTSConnections=0): ' + ($rdp.fDenyTSConnections -eq 0))
$report.Add('NLA Required: ' + ($nla.UserAuthentication -eq 1))

# 2. Scheduled tasks created in last 7 days (persistence check)
$report.Add('`n== SCHEDULED TASKS (last 7 days) ==')
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff -and $_.TaskPath -notlike '\Microsoft*' } |
    ForEach-Object { $report.Add($_.TaskName + ' | Created: ' + $_.Date + ' | Path: ' + $_.TaskPath + ' | Action: ' + (($_.Actions | ForEach-Object { $_.Execute }) -join ';')) }

# 3. Volume Shadow Copy inventory (anti-recovery tampering check)
$report.Add('`n== VOLUME SHADOW COPIES ==')
$shadows = Get-CimInstance Win32_ShadowCopy
if ($shadows) { $shadows | ForEach-Object { $report.Add('Shadow: ' + $_.ID + ' Created: ' + $_.InstallDate) } }
else { $report.Add('WARNING: No shadow copies present - possible T1490 anti-recovery tampering') }

# 4. Local administrators (rogue account check)
$report.Add('`n== LOCAL ADMINISTRATORS ==')
Get-LocalGroupMember -Group 'Administrators' | ForEach-Object { $report.Add($_.Name + ' [' + $_.ObjectClass + ']') }

# 5. New services installed in last 7 days (Event 7045)
$report.Add('`n== NEW SERVICES (last 7 days) ==')
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$cutoff} |
    ForEach-Object { $report.Add(($_.TimeCreated.ToString()) + ' :: ' + ($_.Message -split "`n")[0]) }

# 6. Unauthorized RMM tooling service check
$report.Add('`n== RMM TOOL CHECK ==')
$rmm = 'ScreenConnect','AnyDesk','Splashtop','Atera','TeamViewer','RemoteUtilities','Nable','Kaseya','Syncro','Ninja'
Get-CimInstance Win32_Service | Where-Object { $s = $_.Name + ' ' + $_.DisplayName; $hit = $false; foreach ($t in $rmm) { if ($s -match $t) { $hit = $true } }; $hit } |
    ForEach-Object { $report.Add('RMM SERVICE: ' + $_.DisplayName + ' | State: ' + $_.State + ' | Path: ' + $_.PathName) }

$out = '.\DragonForce_Triage_' + (Get-Date -Format 'yyyyMMdd_HHmmss') + '.txt'
$report | Out-File $out
Write-Host ('Triage report written to ' + $out) -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires):

• vssadmin / wmic / bcdedit / diskshadow execution anywhere outside backup windows (T1490)
• New or unexpected RMM agent installations (ScreenConnect, AnyDesk, Atera) on servers or the DC
• Archive staging: 7z/rar executions against file-server shares; new large archive files in user or temp directories
• rclone / megacmd / WinSCP execution or egress to consumer cloud storage endpoints
• Mass discovery: nltest, net group /domain, dclist, ADFind-style LDAP sweeps
• New local/domain accounts (especially generic names like "support", "backup", "svc")
• Event 7045 service installations outside maintenance windows; PSEXESVC anywhere
• LSASS handle access by non-system processes (credential theft pre-staging)

Critical Assets DragonForce Prioritizes for Exfiltration:

• File servers: finance, HR/payroll, legal, and executive shares
• Healthcare victim environments: EHR/practice-management databases and imaging archives (PHI = leverage)
• Manufacturing: ERP/MRP exports, CAD/engineering drawings, customer contracts
• Hospitality: POS backend databases, guest PII, loyalty program data
• Email stores (on-prem Exchange), NTDS.dit from domain controllers, and Veeam/backup repositories (targeted for both theft and destruction)

Containment Actions — Ordered by Urgency:

1. Isolate affected hosts/subnets via EDR network isolation or switch-level ACLs. Do NOT power off — preserve volatile memory for forensics.
2. Disable edge VPN concentrator access and force credential resets; revoke active sessions on Check Point / VPN gateways.
3. Kill and uninstall unauthorized RMM agents; block RMM vendor domains at egress except the approved platform.
4. Reset domain admin and service account credentials; rotate KRBTGT twice if DC access is suspected.
5. Block identified exfil destinations (cloud storage, paste sites, attacker infrastructure) at the egress proxy/firewall.
6. Activate IR retainer, legal counsel, and communications plan; preserve logs before retention rollover.

Hardening Recommendations

Immediate (24 hours):

• Patch or mitigate CVE-2026-50751 (Check Point IKEv1 improper auth), CVE-2026-20131 (Cisco FMC/SCC deserialization), CVE-2024-1708 (ScreenConnect — patch server or decommission), CVE-2023-21529 (Exchange), and remove malicious Nx Console builds (CVE-2026-48027)
• Enforce MFA on all VPN and RMM access; disable IKEv1 Aggressive Mode where not required
• Enable NLA on RDP; restrict RDP to VPN-only or jump hosts; audit external port exposure
• Deploy the Sigma ruleset above; enable ASR rule blocking credential theft from LSASS and volume shadow copy tampering
• Audit scheduled tasks and services for the last 14 days; inventory and allowlist RMM tooling

Short-Term (2 weeks):

• Implement tiered administration and phishing-resistant MFA (FIDO2) for privileged accounts
• Deploy EDR with tamper protection across all servers including the DC and backup infrastructure
• Egress filtering with TLS inspection alerting on unsanctioned cloud storage and file-transfer tooling
• Immutable/offline backups (3-2-1); test restore of at least one critical workload
• Segment networks — especially manufacturing OT/IT boundaries and healthcare clinical systems from corporate IT
• Deploy honey credentials and canary file shares to detect pre-encryption enumeration

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub